HospitalInspections.org

Based on interview and record review, the facility failed to ensure that the confidential laboratory results for 6 patients (Patients A, B, C, D, E, and F) were protected when the newly instituted automated faxing program sent them to the wrong provider. This resulted in a breach of protected health information (PHI) for all 6 patients.

Findings

On 6/26/12 at 11:00 AM, an investigation was initiated on an entity-reported event of a possible breach of PHI for 6 patients.

During a phone interview , the privacy officer relayed that a new automated faxing program had been in service for less than a week. Some of the providers' fax numbers that existed in the system had not been confirmed prior to implementing this program. This resulted in Patients' A, B, AC, D, E, and F's PHI being faxed to the wrong place.

A review of the facility policy and procedure titled, "Sending Protected Health Information by Fax" dated 2/12, indicated "Programmed Fax machines shall undergo a fax number verification prior to release for use by staff. A verification request fax will be sent to each preprogrammed fax number on any machine prior to release to staff".

A review of the letters sent to the six patients indicated this was a breach of PHI by the facility.